CVE-2019-20102

MEDIUM 6.1CVE-2019-20102 · Published 22/04/2020 · updated 17/06/2026

In short

CVE-2019-20102 is a MEDIUM (CVSS 6.1) vulnerability affecting confluence server (atlassian).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.3% of all vulnerabilities.
Fix: update to 6.15.5 or later.

Package	Affected versions	Patched versions
confluence server atlassian	`≥ 6.14.0, ≤ 6.14.3≥ 6.15.0, < 6.15.5`	`6.15.5`

Description

The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.

References

jira.atlassian.com/browse/CONFSERVER-59358 · Permissions Required

More vulnerabilities in confluence server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

confluence server

atlassian

≥ 6.14.0, ≤ 6.14.3≥ 6.15.0, < 6.15.5

6.15.5

More vulnerabilities in confluence server

See all →